# Air-Gapped Network Security Monitoring

> Network security monitoring for air-gapped and offline networks: no internet, no telemetry, no license server. Discover endpoints, analyze firewall config, and detect changes across vendors, fully self-contained.

Last updated: July 2026

SAMURAI is a self-contained network security and monitoring platform built to run in air-gapped, classified, and restricted environments. Once the image is on the network, it needs zero external connectivity.

- **No internet required after install**: transfer the Docker image across your boundary once, then run fully offline. No license validation, updates, or analytics callbacks.
- **Offline endpoint discovery**: a 39,000-entry IEEE OUI database ships embedded, so vendor identification resolves locally.
- **No telemetry or license server**: authentication and licensing run locally; the only traffic is to the devices you monitor.
- **Self-signed TLS by design**; bring your own PKI for the platform HTTPS.
- **Sneakernet-friendly**: pull the image on a connected machine, move it with docker save and docker load, run it inside the enclave.

## Why most tools cannot go air-gapped

| | SAMURAI | Cloud-dependent tools |
|---|---|---|
| Connectivity needed | None after the image is transferred | License checks, updates, or cloud backend |
| Vendor lookups | Offline embedded OUI database | External API calls at runtime |
| Deployment | docker save and load across the boundary | Online installer or SaaS onboarding |
| Data residency | Everything stays inside the enclave | Data or metadata sent to the cloud |

## Frequently asked questions

### Can SAMURAI run in a fully air-gapped network?

Yes. After the Docker image is transferred across your boundary, it needs no internet at all: no license server, no telemetry, no update checks, no external lookups. Everything runs on one VM inside your perimeter.

### How do I install it without internet?

Pull the image on a connected machine, move it across with docker save and docker load, and run it inside the enclave. All dependencies and databases are embedded.

### How does endpoint vendor lookup work offline?

SAMURAI ships a 39,000-entry IEEE OUI database embedded in the image. MAC-to-manufacturer resolution is a local map lookup, so no external API or DNS is involved.

### Which environments is this for?

Government, defense, OT and industrial, financial, and critical-infrastructure networks isolated from the internet by policy, plus any segment where firewall configuration must not leave the perimeter.

---

Canonical page: https://nometa.az/en/air-gapped-network-security/
Part of SAMURAI, a self-hosted, multi-vendor network monitoring & security platform. Overview: https://nometa.az/llms.txt
Contact: info@nometa.az · Docker Hub: https://hub.docker.com/r/beyrak44/samurai